4 ms·

The folks at Android Police posted about it weeks ago: http://www.androidpolice.com/2013/07/11/second-all-access-apk-exploit-is-revealed-just-two-days-after-ma

by MrKurtz 13y ago

The folks at Android Police posted about it weeks ago: http://www.androidpolice.com/2013/07/11/second-all-access-apk-exploit-is-revealed-just-two-days-after-master-key-goes-public-already-patched-by-google/ http://www.androidpolice.com/2013/07/11/second-all-access-ap... It also was already patched. Good write up though.

britta 13y ago
saurik explains in his introduction why his article is different (and potentially worth reading even if you've read other articles): > Later articles were written about this bug, each examining the same exploit technique, coming to the conclusion that this vulnerability offered less abilities than the Master Key exploit, due to very narrow and unlikely requirements that the original signed application package must satisfy. > In this article, I document different exploit techniques for this bug that do not have these limits; in fact, the second exploit described here provides much more capability than the Master Key exploit, allowing arbitrarily complex packages to take on the signatures from arbitrary signed packages. Finally, I look at the history of this bug in Android, showing when it was introduced.
- saurik 13y ago
  Correct. In fact, in my section "Serious Limitations", I directly reference the article from Android Police and quote from its at-the-time understanding of the vulnerability.
agent123 13y ago
A commit to a repository does not equal a patch to the half billion vulnerable devices in the field.
- brokenparser 13y ago
  Yes, captain obvious? What do you suggest?
  - agent123 13y ago
    Instead of minimizing or dismissing serious problems as 'already patched', hackers could help by warning consumers about the proliferation of Android malware. If sales were jeopardized, vendors would start caring about updates.
    - brokenparser 13y ago
      So your suggestion is to pass the buck onto "vendors"? Who are they and what can they do about it? Think outside the box!
      - agent123 13y ago
        You don't seem to have any understanding of how Android works. The buck does stop at vendors since they are the ones who ship OS updates to consumers. Vendors don't prioritize updates because their customers don't understand enough to make this part of their purchasing decision, so there is little incentive for them to spend resources on it. Minimizing this major problem doesn't help. And - instead of saying 'think outside the box' - why not actually contribute some out of the box thinking?

by MrKurtz 13y ago

britta 13y ago

saurik explains in his introduction why his article is different (and potentially worth reading even if you've read other articles): > Later articles were written about this bug, each examining the same exploit technique, coming to the conclusion that this vulnerability offered less abilities than the Master Key exploit, due to very narrow and unlikely requirements that the original signed application package must satisfy. > In this article, I document different exploit techniques for this bug that do not have these limits; in fact, the second exploit described here provides much more capability than the Master Key exploit, allowing arbitrarily complex packages to take on the signatures from arbitrary signed packages. Finally, I look at the history of this bug in Android, showing when it was introduced.

saurik 13y ago
Correct. In fact, in my section "Serious Limitations", I directly reference the article from Android Police and quote from its at-the-time understanding of the vulnerability.

agent123 13y ago

A commit to a repository does not equal a patch to the half billion vulnerable devices in the field.

brokenparser 13y ago
Yes, captain obvious? What do you suggest?
- agent123 13y ago
  Instead of minimizing or dismissing serious problems as 'already patched', hackers could help by warning consumers about the proliferation of Android malware. If sales were jeopardized, vendors would start caring about updates.
  - brokenparser 13y ago
    So your suggestion is to pass the buck onto "vendors"? Who are they and what can they do about it? Think outside the box!
    - agent123 13y ago
      You don't seem to have any understanding of how Android works. The buck does stop at vendors since they are the ones who ship OS updates to consumers. Vendors don't prioritize updates because their customers don't understand enough to make this part of their purchasing decision, so there is little incentive for them to spend resources on it. Minimizing this major problem doesn't help. And - instead of saying 'think outside the box' - why not actually contribute some out of the box thinking?